You cannot add any custom headers this way.
The established way to add user specific authorization is to have a session cookie. If such a cookie is set for the target URL (i.e. the user is already authenticated against the target) then it will be sent automatically within the request.
If instead the authorization is not specific for the user but instead some application specific access token you can include it in the URL. If you don't like that it is part of the URL and thus visible in the history you might behave as in the scenario above with the logged in user and cookie based session id. Only that you either set the cookie from within Javascript (in case of same-site request) or get a cookie for the target site by automatically "logging in" with your access token using XHR.
Yet another way is if the target sends a "authentication required" (HTTP status code 401) request back with an appropriate WWW-Authenticate
header. In this case the browser will prompt the user for the login credentials and send these with each request to the site using the Authorization
header.
vulnerability-assessment
tag since it is unrelated in my opinion. If you feel otherwise you might try to add it again but then please add the necessary content to your question so that this tag makes sense.food
tag either if you got the idea while eating or asleep
tag if you've dreamed of the problem.vulnerability-assessment
might make sense for example if you are trying to dispute a report which highlighted this problem.